hxxps://www[.]nsa[.]gov/about/contact-us/National-Security-Cyber-Assistance-Program-NSCAP/

Analysis

max time kernel
8s
max time network
15s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/02/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.nsa.gov/about/contact-us/National-Security-Cyber-Assistance-Program-NSCAP/

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1633	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1632	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1633	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1633	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1646	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1648	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1646	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1648	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1647	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1647	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1645	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1645	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1644	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1644	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1649	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1649	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1653	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1653	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1654	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1655	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1655	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1656	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1656	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1658	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1657	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1659	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1659	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1660	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1660	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1661	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1661	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1662	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1662	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1664	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1664	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1663	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1666	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1667	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1667	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1668	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1670	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1670	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1666	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1666	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1666	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1666	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1678	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/content-prefs.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/favicons.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/places.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/favicons.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/places.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/default	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/places.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/extension-settings.json	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/temporary	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/places.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/ClientAuthRememberList.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/favicons.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/we9rl9hl.default-release/SiteSecurityServiceState.txt	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/task/1793/stat	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/1536/status	Process not Found
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/1684/cmdline	Process not Found
File opened for reading	/proc/1704/cmdline	Process not Found
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/1737/statm	Process not Found
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/1713/cmdline	Process not Found
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1760/smaps	Process not Found
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/1693/cmdline	Process not Found
File opened for reading	/proc/self/task/1816/stat	Process not Found
File opened for reading	/proc/1531/cmdline	Process not Found
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1790/smaps	Process not Found
File opened for reading	/proc/self/fd/108	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/1669/stat	Process not Found
File opened for reading	/proc/1790/statm	Process not Found
File opened for reading	/proc/self/fd/76	firefox
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/task/1767/stat	Process not Found
File opened for reading	/proc/self/task/1628/stat	Process not Found
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/1708/cmdline	Process not Found
File opened for reading	/proc/self/task/1743/stat	Process not Found
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/1562/cmdline	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/97	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://www.nsa.gov/about/contact-us/National-Security-Cyber-Assistance-Program-NSCAP/
1⤵
PID:1530
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1531
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1532
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1538
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1537
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1545
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1544
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1547
- /bin/uname
  uname
  2⤵
  PID:1548
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1550
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1552
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1552
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1552
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1552
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1552
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1552
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1552
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1559
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1562
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1563
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1565
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1564
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1567
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1566
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1569
- - /bin/uname
    uname
    3⤵
    PID:1570
- /usr/bin/which
  which firefox
  2⤵
  PID:1614
- /usr/bin/firefox
  /usr/bin/firefox https://www.nsa.gov/about/contact-us/National-Security-Cyber-Assistance-Program-NSCAP/
  2⤵
  PID:1626
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1627
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://www.nsa.gov/about/contact-us/National-Security-Cyber-Assistance-Program-NSCAP/
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1626
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1631
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1681
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1681
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1681
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1681

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1534

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
PID:1555

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1573

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1578

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1577

/usr/bin/head
head -n 1
1⤵
PID:1576

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1575

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1584

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1583

/usr/bin/head
head -n 1
1⤵
PID:1582

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1581

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1589

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1588

/usr/bin/head
head -n 1
1⤵
PID:1587

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1586

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1594

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1593

/usr/bin/head
head -n 1
1⤵
PID:1592

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1591

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1599

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1598

/usr/bin/head
head -n 1
1⤵
PID:1597

/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1596

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1602

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1605

/bin/sed
sed -e "s|-|/|"
1⤵
PID:1608

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1613

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1617

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1620

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1625

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1652

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{fc1eb108-ff8c-416b-be42-79f93244d9f3}" 1626 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1666

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1684

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1689

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1693

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1704

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
PID:1708

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1713

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{3a2d4966-be7b-4d73-b2d3-b3938774f689}" 1626 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1737

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21418 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{d081fabc-4f1c-4f71-9ea6-ccbf5df6050f}" 1626 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1760

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{cefe969d-ebcd-4cbd-b43f-1e6dddb11ca1}" 1626 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:1790

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{92943662-3901-4f81-9a9c-50877e135c26}" 1626 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
103e0e8ccf0ca3ad7dc8df388c4d02db

SHA1
ace6f761db204030c1a65c0930bd01fd55ecc429

SHA256
b4c43b50bf245bd727623e3c775a8fcfb8d823d00b57dd65f7f79dd33f126315

SHA512
e780d066ac5f4fda87e8c37ac1e2bfb287c995afb0a3a67c4a1ccb16db8a6e5ec4f98c6b5974abd25ab63b980894f4a34f87321015b8c79b0fa6ac94661df53d

Download Submit
/root/.cache/mozilla/firefox/we9rl9hl.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
2e418bf9f0e868fbb4437922bd3f21c1

SHA1
acc4b5c161a7920d554b214bf5f7eb3d68bff9ce

SHA256
4abb57471d5c0a1de78d7c5a920be0881f77dbcbd9c8bd199f46c75a1e0aa893

SHA512
65e17e90e0dd209367e0eba2b26c7243b185c7d452349f0f1f8ad019e084fff751a3a1e402c7047a648960c10d363534dc3b558ca5d1fa2266f097b5f2e0d206

Download Submit
/root/.cache/mozilla/firefox/we9rl9hl.default-release/cache2/entries/B6EF9684923F6FF8B461CADAD22CE8EA854EE8EB

Filesize
30KB

MD5
eaa05d0f86f208d364a5c1fa7194f497

SHA1
895e34f198a27b1cec8c53552aceb0cb533f4248

SHA256
e1be158ca101061ff4575ff745aaa41b648eb4450a1d9b6c1dae604b07fb6745

SHA512
fbf3323224383904ed0a300b7ad54723ec0a70cea400d2faaa8e8db48f244885b1f8b7a3807878071794888b5afca944185d840c17b43199ac0fb1c607ca43ff

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
26e7ef1af7af999082315a5c87b71744

SHA1
473be1a3350e932b43d2ea506a2cb3722f3c291b

SHA256
0018444a26a0cbacfd0157aa6327c905a84d5e8ebb3c9c00afb8bd96018cd3a7

SHA512
9b6442af99f9977f0bf46054a748e97008c1c97b0c578a9a1f399b45a17c8e02c49eff4e908dde51882aae52a4ba1a9a9af275b851e3f43d630ba63210eddcce

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
881b63b575bcc9ebca0ac5f56054fe5d

SHA1
a52d0ce063fa42a116f754561728f9d7f824b075

SHA256
482851a5578ab8bf246e4c85afbc3167b3513431d81a4dddbdc3f19d7a22e137

SHA512
fddea9af187b94e3a300be95cbac7d4915711f2476ecbfab1267b2b7c3d13916149fca283ef16cba0833a5533fe6ea4cf604ca8193d1f1d37a0cb4b53c63ddbd

Download Submit
/root/.mozilla/firefox/dt7j38vc.default/times.json

Filesize
47B

MD5
28be053652bb3ed7308a095cf7302407

SHA1
c3b44cc6ccd4d969665f70886a519567bd0d4a58

SHA256
eefcc19430c15aa8127186ec1ff8aa4631e097bc9ea3a051c76c0e5bf8fc32b8

SHA512
fca49f6980ee96f16c424956cf34feb010c9c0d76bca29524464d38538427c2cf3ec6e56651ce9dd6457663bc5bddfa0b7bdfe78cb83fcd6210ccc2be8f6aef9

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
b3b3371b3adedb615b6803696dc9eaa7

SHA1
37a395acbf57d246de9a6b755178e7ee9e6e2810

SHA256
2d4a26b3fa73e620a0229e37e98be5f4186e7a826b9b936cc1627553f65e95c6

SHA512
8dd51db3eb06b3f8e8d010473c721457b2ee76f70b935a164c15a85c6f755f03ddecaeafbe4249a14d31f5d6d74721641281d1343f330378cb4c38c2966b8104

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
75473c27290fed8fba092cfef4ec6236

SHA1
2dcb5a5ffb8a94ea5281c65247f9749173a8d18e

SHA256
6e95d8e0006800502ff710f0ff4a5a2d11ab427427591344acb7d22a0ff0f453

SHA512
1de409d910de15d510ac134b9567880b151e08d95c9b1f22c1c975b4d30a7f19767302ba4e869d1f23f27e5da9c367a5be195c3a4783b8572cd92e32b59a12ce

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/cert9.db

Filesize
224KB

MD5
9dcbfc6a755374949e98505e68e59c84

SHA1
9fa51f2e20143fae4fe177113632820d8cb96428

SHA256
880fa968b42cf4c8e66aabc5a05122ee47520725ce32d8ce0e093d89ce7c8c7a

SHA512
2a9ac79e28191a40901cf2690becce459aa8c109aa4e5ca39cf5ee0bd0078ea043f76355e82ea63bd45e8437387e09ec4e5712d22d320684d4d699fe477af79b

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/cert9.db

Filesize
224KB

MD5
dda3f194df6c800dff5071419e2e1848

SHA1
a45f11add3167b6201fdb1e3622a35b25153af58

SHA256
219ff8e682e2ab45c6bb1e1ecfeddeec8d7152fc8d3487cd171a11097e483a6d

SHA512
26d9156290f23cb2c3d043a2088a814a0d555481277c3f3d561c1169788787debd33bc464866a458233b3f50fa79bd27bae3c8cd1efaf78dfc42595d1e97ce1a

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/cert9.db

Filesize
224KB

MD5
92f36a802f60dc6a01f9e7a86d86314f

SHA1
d08a056f74417c62eae02ac26adea71bad414f98

SHA256
f9ec256edd1ab5581eb5d6f8ec5754365e02450c62b88e59a19d4901e8a3bdb9

SHA512
b148f3bc4fe1e07a410781a36e782d8ec892ab05f8dd567756f3e0b5c88c14ff38248c6f0ef451839fecfc63a9c7f11a1b2e3e30acd9a0100bc07fe9540b0dd0

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/favicons.sqlite

Filesize
224KB

MD5
3c0a1ec298284608bfa51081ea539be3

SHA1
e51b58f6fe89d45fd8a1d935b51da172d5f6f32e

SHA256
34c4fe7ab2d3e44f193b489ebe84c17d67b336546af9ef231897ec09d7ff16f2

SHA512
8550f530377f7a98c46a6989bec2c43ed644274509a5b987e8e0d034bf867b3315dcc75a2c851a5ac43a45b40bf51c789d828a9a69c02157b3e900467341a28f

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/key4.db

Filesize
288KB

MD5
25bcbc7c18f4a7e88f8271c55a01f2a1

SHA1
9f98354ae05f59ab3f5d49ac996aa298bb64f8f7

SHA256
a41199e84d6f7f8747acee4c03b9ad04629405fcd702c1c11698314b138bd390

SHA512
955533ac9a6de8423c3da6c52867fd87913f3f0e808d8a203d31773ba433d9ecf081c597faef965c5c13933267d070420e00956a210a8fe0a1e9c61e769ebc60

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/permissions.sqlite

Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/places.sqlite

Filesize
1.3MB

MD5
38c564c5814863de3666272c43092bf2

SHA1
9ae9ca022ee3e8d5c82de6ab179f45363202241a

SHA256
63626fe6329ee2f293492dc704427f9b7b612414b306a3c8ded927331cd4cf97

SHA512
3944bf5a828fb351d9a3b861f1fedf03348704eecd8799be59e02ab1bf03ca1e5a8448fffa47f5b0d148a23dab0c4a58787ec0d81210eddd25a8d367d1e244f7

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/prefs-1.js

Filesize
1KB

MD5
b1b0f2cf4bbfe68ce90cc96520e8afa2

SHA1
b02ebab7053be44e61cda26ec1b5c33a364a4edb

SHA256
75a36950b61a8572e67e35d2cc0ba1b3d069b21183b8fb6eb2d0e1975b2fc62e

SHA512
b974b97cd5506f8666babe297cea2cebacacb46007e8eabfb0a3bd0b3dd2074c4f7c190e25d09684de097f9eed964d54865f280b618b57566836a0273d4992c8

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/prefs-1.js

Filesize
2KB

MD5
646769a51f580ca123973dddfb4bffd4

SHA1
5bd6ebcb1bc15fd96c5f6e5ac31a159678b38285

SHA256
d641db17334e97e3beaf540c6c517b85f969c89b46c89ad6b772f49edaec43ae

SHA512
8f92b104cc2200ee9316beb074178e7fdb850402568e432509ed51d052ac6247d5334abbfef6bbcdbe7306f95b76bf9c92e064d614a094f8d89998400a49161d

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/prefs-1.js

Filesize
2KB

MD5
90b517e5cd4be4fd5a0ca82f63ea4754

SHA1
b21542a07583a77bc6a256c0bcac1531846dd525

SHA256
a93745c0dadfa2a36ce2c52f50ba4c5082c713cd154098b4f66aa60c494a2507

SHA512
fe3822fb7a668ef2c042cb4bc5263c85b33de57dc89e922c7742c8b966f7ae37d0811015682353014bae574c0b63c4b7546f842e51d65a370862c099c041df0a

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/prefs-1.js

Filesize
3KB

MD5
282e418137d78e13af85f9276b5423e6

SHA1
f1f330aa0b0e982ceda13441c227591e9c82e1fb

SHA256
c0f3b42218236dc4f162ac87395de4b0af4ef20d0cc867574ff796c9ed8cf866

SHA512
ef50ad1723075182da6b200c0341db43501643807b8351d889f0f9703db0f1e6a1c84f4a382acd65890a228077f0953aa6cb23e8ea843455150b8edb17147138

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/prefs-1.js

Filesize
4KB

MD5
6f38fa1fe4a1fcdb715f18359b35c39e

SHA1
1b26830c81e321bc9d2ac862a0c0e938c86247c1

SHA256
449da7533a6ec68f73a86c693cb9bd7de6146840550f690c21e7deae6e6619a3

SHA512
0612f0ef0c52f22bd3d008913c5177fe4ce153b44fce2881d2d99fbae1219cc053b59b3e0c7c3457c7d7395ba2a3e55c4ec915d669023eac2fc0b3fa46563ec9

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/prefs-1.js

Filesize
4KB

MD5
34e49a515af713c524593b5deee95eaf

SHA1
f95f7bcd47b347686d61ebcc0642224640b5d0ab

SHA256
d32075ab4c678829b153c4c9cd92b6fa957e98cc2d213a0037af3a4f7746f0a4

SHA512
10d848ce3b972999956ca7c50e4dad25a2b897884e4fdb876129b99296c4db09b627d04a1ed11749c6e4bc9f2949d0378955524223cb805de08e8233b1e5501d

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/prefs.js

Filesize
1KB

MD5
6fef7065d12b5db76a530dd7b9be92b6

SHA1
75aa7fe18a0753d7e59578cd0c8a3c630f3fd09e

SHA256
b4dd429e425eac2e0e5a672beb56c0353b31a57da6f009b54f163b746ba111ee

SHA512
f4efc2e34101b13b660408ab7b678a103fa3c1342fa8838a9a83954d4a149c90d67bed9dcf69211f5f7496afa89cf90b7919a547700f7fce9e88a699d651b9f4

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
3953c5da695f181251a0e18e38a70027

SHA1
0538d91023a688184b5f4a20ecacbfdd17b168cc

SHA256
1a932ff9de915407606325f3784ad9b97a819fec8a649b1da69de3378800a9df

SHA512
fc850a0e8ae70000ad9473b720371d40fc6b72d0462db293a83279dbba5b6ab7c337ae204b918e9b7ea10847ab09eabe688161b47d0c59e6290783b4e5d00f67

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
e25795f69219683f2ee397a9de4bae8b

SHA1
973af10b2e99ed8b2b2b553f448f012da624c8e9

SHA256
2a09b28bc70b494aeb2723acdac38469b826e5335baf3fbc32e4819cda6958f2

SHA512
4d57ac0cefac5346d5cbbf6f7d9c214f59d82bda7362805995e0828ba1130dd8340eb26869c51d641bd83d138941250a04e766d62bf0ecf2e142685279d1316b

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
ded77713b615d900c57ed1fc29f88568

SHA1
fd3bf7c018ca56b835f25ab8feee2a298b8d51fd

SHA256
cb3750300d72b4a1601111afe39a4a7d4bcb7a8f5c4c4aa1ec6287ab66995ddc

SHA512
816edcc9268a5da71d74cc4fa1d792db7b29acd9c9b6f29bb2ce2974a88a25d719bae34ca8de38cbc858028d02545a6ac7e3b963adb0eb17c7634624bf4d6193

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
f96904c34a5b8005ffd1a740231fd103

SHA1
bd588a63a4058b71f5a0c291005be172991488da

SHA256
b5e7481af3a51e5c8a99e3c38bd31cb674f78097cc108ead19cd06d5317fe4d9

SHA512
42292f8469ff7cc7a43481a92f40498f4ae0f078681eb8ebbe2974f6bad921c71a4d0248800ec8fe2ab0387f0d078561fa013e8fc5252cd832a6711c167affbc

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
17e644b1fa079251a19353c2715dfd53

SHA1
87d543a82d3cce1be4d543b90de28ae7075c4ee6

SHA256
3a1dfc124c41fd8d0bd3205d037d4f48f4e5bb47aec6a36ce6bd510451f2bb5e

SHA512
fe7a1dc64b7d2370f3707ff4b842ae5199bab7e8cea958aab67494b878e05fa0e2555d2df653d6af3a8916ae8d1f690ae210ce6e8995447bd00f046385e571c7

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
6822d7b772cc09aec56f7c4f635bed51

SHA1
8a6395bf2c41830e7af7b9528040d013e73f86e8

SHA256
a2aee5bce6880e3671d2ed4bfda51eb09dea56ddb1e9a2c84b9de64463839a67

SHA512
9fdd36576c10c7838bd8b1df34b65d707a4261148b2c5d2ee7d3a93adbb33095d0e2606cd013bb4a22ae23d899a894fda39d6558cd5173658ee4e0c54bbf5084

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
43fe0ebd003aefd26e93cc353fd4807a

SHA1
f5f0c77bde4970e1a1c8ae1c6fb55c1824a11109

SHA256
ad27dbfafe97f3e4cd2a5f7342330dc1c2e564e48ba982b0d03b449847adf011

SHA512
f373a8dc094cf73f3b1622ed2b790e51378caa032a1976d3e6e9cbdf2967887ea717eda01929bee9328f4a22e3930b81b653f2c070278d3612d62048742dbbc2

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
232KB

MD5
02dab7dd59ab6ccf75cd73d0d4ca7cc0

SHA1
28c0b9bd95f09a1674260e501e9ec9cdcb0eb6c4

SHA256
92c0cfde3837ce37353c3c54839c7f7a067622c886131a99b9b74eed837df00e

SHA512
9da3abe0c6fad322aaf28dca0ef5964006f435a7b1505c474762c98bd6ac71f07ee83df881aa97f3991c17b528f45e3a27f3a7060977e1f76ae9a5afaaa01a5e

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/times.json

Filesize
50B

MD5
a9924f0fd665d76f468afb236a49693b

SHA1
f67c805ddd6dd03f03d578b8267e4848724bbed7

SHA256
dc9e28b373e99df72267a18080b88348406272ac1b82cdfb00f5d51a45bc2def

SHA512
500412c26b36af2b580c5c908a7dc9f72e389ce3823d2fa82638bcf6827a6db1a790b010b0a143b40ee0428e2f41021aefe13845f2da31f5529fdeefe68e8e54

Download Submit
/root/.mozilla/firefox/we9rl9hl.default-release/times.json

Filesize
47B

MD5
c5bbec41b2cee7147826de3b5c92f418

SHA1
174cf62b789ac41e69bc5e8af15fc63cd8b7fb76

SHA256
3ccd2857609aa485d3022b50f0968e60d6e58b1de24c3153e74de737ecec47fb

SHA512
fb692b66172f87386abb615d032f0b2b1d8fb760ebff5c6692eeadcf9faae56b9aa745e077a600f5c2da1a8a1830039fb9134447819805b4d5a0749e629fdbc0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads